@github/copilot-sdk 1.0.13-preview.6 → 1.0.14-preview.0

package/dist/generated/rpc.d.ts

@@ -3,7 +3,7 @@
  * Generated from: api.schema.json
  */
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
-import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerSource, McpServerStatus, ModelChangeSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
+import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionDecisionSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
 /** A value that can be represented losslessly on the SDK JSON wire. */
 export type JsonValue = null | boolean | number | string | JsonValue[] | {
     [key: string]: JsonValue;
@@ -253,6 +253,20 @@ export type AuthInfoType =
  */
 /** @experimental */
 export type AuthValidationErrors = AuthValidationError[];
+/**
+ * Current normalized autopilot objective lifecycle status.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AutopilotObjectiveStatus".
+ */
+/** @experimental */
+export type AutopilotObjectiveStatus = 
+/** The objective is actively running. */
+"active"
+/** The objective is paused and may be resumed. */
+ | "paused"
+/** The objective completed. */
+ | "completed";
 /**
  * Root JSON Schema type for a built-in tool input.
  *
@@ -317,6 +331,124 @@ export type CardDigestValue = string;
  */
 /** @experimental */
 export type CatalogCandidateSource = CatalogCandidateSourceUrl | CatalogCandidateSourceEmbedded;
+/**
+ * A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshot".
+ */
+/** @experimental */
+export type CatalogTrustSnapshot = CatalogTrustSnapshotCurrent | CatalogTrustSnapshotAbsent | CatalogTrustSnapshotStale | CatalogTrustSnapshotDowngraded | CatalogTrustSnapshotRevoked | CatalogTrustSnapshotUnsupported | CatalogTrustSnapshotMalformed;
+/**
+ * Schema version of the catalogue trust snapshot envelope
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotSchemaVersion".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotSchemaVersion = 
+/** Initial envelope carrying one bounded service tier or one explicit unavailable state. */
+"v1";
+/**
+ * A recognised T1 or T2 service tier was observed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotCurrentStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotCurrentStatus = "current";
+/**
+ * Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustTier".
+ */
+/** @experimental */
+export type CatalogTrustTier = 
+/** Tier one as assigned by the catalogue authority. */
+"T1"
+/** Tier two as assigned by the catalogue authority. */
+ | "T2";
+/**
+ * Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustEligibility".
+ */
+/** @experimental */
+export type CatalogTrustEligibility = 
+/** Eligible for default catalogue exposure. */
+"default"
+/** Eligible only when expanded or community results are requested. */
+ | "expanded"
+/** Not eligible for normal catalogue exposure. */
+ | "hidden"
+/** The authority did not supply an eligibility decision. */
+ | "unknown";
+/**
+ * Bounded authority that supplied a catalogue trust observation
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSource".
+ */
+/** @experimental */
+export type CatalogTrustSource = 
+/** GitHub Agent Finder supplied the trust field on its search result. */
+"agent-finder";
+/**
+ * The authority omitted trust metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotAbsentStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotAbsentStatus = "absent";
+/**
+ * The authority explicitly marked its assessment stale.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotStaleStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotStaleStatus = "stale";
+/**
+ * The authority explicitly reported a downgraded assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotDowngradedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotDowngradedStatus = 
+/** The authority explicitly reported a downgraded assessment. */
+"downgraded";
+/**
+ * The authority explicitly revoked its assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotRevokedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotRevokedStatus = "revoked";
+/**
+ * The authority supplied a bounded trust value this runtime does not understand.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotUnsupportedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotUnsupportedStatus = 
+/** The authority supplied a bounded trust value this runtime does not understand. */
+"unsupported";
+/**
+ * The trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotMalformedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotMalformedStatus = 
+/** The trust field was empty, unbounded, or had the wrong JSON type. */
+"malformed";
 /**
  * Why the catalog authority did not accept the caller's identity
  *
@@ -392,7 +524,9 @@ export type CatalogCapability =
 /** Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled. */
  | "mcp-install-planning"
 /** Understands plans that enumerate every eligible transport rather than a single preferred one. */
- | "multiple-transport-choice";
+ | "multiple-transport-choice"
+/** Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field. */
+ | "trust-snapshot";
 /**
  * Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability.
  *
@@ -629,6 +763,18 @@ export type CatalogUnavailableTransportReason =
  | "transport-not-supported"
 /** Eligible remotes could not be enumerated, so no explicit choice can be offered. */
  | "remote-enumeration-unavailable";
+/**
+ * Why the runtime requests client-task cancellation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ClientTaskCancelReason".
+ */
+/** @experimental */
+export type ClientTaskCancelReason = 
+/** A caller requested task cancellation. */
+"cancel_requested"
+/** The session is shutting down. */
+ | "session_shutdown";
 /**
  * Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
  *
@@ -708,6 +854,20 @@ export type ConnectedRemoteSessionMetadataKind =
 "remote-session"
 /** GitHub Copilot coding agent session. */
  | "coding-agent";
+/**
+ * Closed set of public task kinds a connection can negotiate.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskKind".
+ */
+/** @experimental */
+export type TaskKind = 
+/** Runtime-owned background agent task. */
+"agent"
+/** Runtime-owned shell task. */
+ | "shell"
+/** Client-owned externally executed task. */
+ | "client";
 /**
  * Controls how MCP tool result content is filtered: none leaves content unchanged, markdown sanitizes HTML while preserving Markdown-friendly output, and hidden_characters removes characters that can hide directives.
  *
@@ -937,16 +1097,16 @@ export type EventsReadDirection =
 /** Tail-first: return the newest events and page toward older events. */
  | "backward";
 /**
- * Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
+ * Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "EventsCursorStatus".
  */
 /** @experimental */
 export type EventsCursorStatus = 
-/** The cursor was applied successfully. */
+/** The read succeeded against the requested history. */
 "ok"
-/** The cursor referred to history that is no longer available. */
+/** The requested continuation is unavailable; see the endpoint's recovery semantics. */
  | "expired";
 /**
  * Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
@@ -1074,6 +1234,8 @@ export type FactoryRunStatus =
  | "completed"
 /** The run was interrupted while resource budget remained. */
  | "halted"
+/** The current attempt stopped intentionally and the run may be resumed. */
+ | "paused"
 /** The run was cancelled before completion. */
  | "cancelled"
 /** The factory body failed or reached a cumulative resource ceiling. */
@@ -1091,6 +1253,10 @@ export type FactoryRunFailure = {
      * Approved effective ceiling that was reached.
      */
     value: number;
+    /**
+     * Suggested larger ceiling when the runtime can derive one safely.
+     */
+    suggestedValue?: number;
     /**
      * Factory run identifier.
      */
@@ -1163,6 +1329,28 @@ export type FactoryRunFailureKind =
  | "timeoutSeconds"
 /** The run's settled subagent model usage exceeded the approved AI-credit ceiling, or no headroom remained for another subagent. */
  | "maxAiCredits";
+/**
+ * Durable metadata describing who initiated a factory pause.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseInfo".
+ */
+/** @experimental */
+export type FactoryPauseInfo = {
+    /**
+     * Factory pause initiator discriminator.
+     */
+    type: "user";
+} | {
+    /**
+     * Stable author-defined checkpoint key that initiated the pause.
+     */
+    key: string;
+    /**
+     * Factory pause initiator discriminator.
+     */
+    type: "checkpoint";
+};
 /**
  * Kind of factory progress line.
  *
@@ -1175,6 +1363,18 @@ export type FactoryLogLineKind =
 "log"
 /** A named factory phase marker. */
  | "phase";
+/**
+ * Action the runtime selected for a durable factory pause checkpoint.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseCheckpointAction".
+ */
+/** @experimental */
+export type FactoryPauseCheckpointAction = 
+/** The checkpoint was committed by a prior paused attempt, so execution may continue. */
+"continue"
+/** This attempt claimed the checkpoint and must cooperatively stop. */
+ | "pause";
 /**
  * Derived lifecycle state of a factory phase.
  *
@@ -2278,6 +2478,18 @@ export type ModelListRequest = {
      */
     skipCache?: boolean;
 };
+/**
+ * Whether the requested preference was already effective or was accepted for later transactional activation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSwitchAutoTierStatus".
+ */
+/** @experimental */
+export type ModelSwitchAutoTierStatus = 
+/** The requested preference is already effective. No activation is pending for it, although this request may have cancelled an earlier unclaimed preference reported in `supersededAutoTier`. */
+"unchanged"
+/** The request was accepted but has not committed. A later user turn using the `auto` model must mint and validate the replacement before it becomes effective. */
+ | "pending";
 /**
  * Provider type. Defaults to "openai" for generic OpenAI-compatible APIs.
  *
@@ -2416,22 +2628,6 @@ export type PermissionDecisionOutcome =
  | "autopilot_denied"
 /** The response came from an interactive user prompt. */
  | "prompted_user";
-/**
- * Controlled reason or actor responsible for a permission response.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionDecisionSource".
- */
-/** @experimental */
-export type PermissionDecisionSource = 
-/** The response followed the assisted-approval judge recommendation. */
-"assisted_approval"
-/** A human supplied the response through an interactive prompt. */
- | "human_response"
-/** The host applied a standing policy or override rather than a judge recommendation or human decision. */
- | "host_policy"
-/** The host denied the request because no interactive user response was available. */
- | "unattended_fallback";
 /**
  * Client surface that submitted a permission response.
  *
@@ -2544,6 +2740,18 @@ export type PermissionsSetApproveAllSource =
  | "user_setting"
 /** Allow-all was enabled through an RPC caller. */
  | "rpc";
+/**
+ * Where completed plugin content was staged before atomic promotion.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PluginInstallStagingMode".
+ */
+/** @experimental */
+export type PluginInstallStagingMode = 
+/** A sibling of the installed-plugins root, outside the recursively watched tree. */
+"external"
+/** A sibling of the destination plugin directory, used when external staging is unavailable. */
+ | "destination_sibling";
 /**
  * Optional flags controlling which side effects the reload performs.
  *
@@ -3150,6 +3358,68 @@ export type SessionsOpenProgressStatus =
 "in-progress"
 /** The step has completed successfully. */
  | "complete";
+/**
+ * Client metadata outcome for one requested local session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionsClientMetadataEntry".
+ */
+/** @experimental */
+export type SessionsClientMetadataEntry = {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    metadata: ClientMetadata;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "ok";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "notFound";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "corrupt";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "unsupportedVersion";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Filesystem or provider error code. Clients should not assume every provider uses operating-system error codes.
+     */
+    code: string;
+    /**
+     * Human-readable diagnostic message. Not stable for programmatic matching.
+     */
+    message: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "unavailable";
+};
 /**
  * Authentication credentials accepted by session.gitHubAuth.setCredentials. Session-owned token-provider identities cannot be installed through this method.
  *
@@ -3204,6 +3474,14 @@ export type SessionSettingsPredicateName =
  | "trivialChangeEnabledForTool"
 /** Whether trivial-change skip behavior is enabled for a specific tool. */
  | "trivialChangeSkipEnabledForTool";
+/**
+ * Ordered client metadata outcomes for the requested local sessions.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionsGetClientMetadataResult".
+ */
+/** @experimental */
+export type SessionsGetClientMetadataResult = SessionsClientMetadataEntry[];
 /**
  * Which session sources to include. Defaults to `local` for backward compatibility.
  *
@@ -3340,13 +3618,154 @@ export type TaskExecutionMode =
 /** The task is managed in the background. */
  | "background";
 /**
- * Tracked task union returned by task APIs, containing either an agent task or a shell task.
+ * Active status a client owner may publish with a progress update.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientActiveStatus".
+ */
+/** @experimental */
+export type TaskClientActiveStatus = 
+/** The external owner is actively working. */
+"running"
+/** The external owner is connected but waiting. */
+ | "idle";
+/**
+ * Client-owned tasks always execute outside the runtime in background mode.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientExecutionMode".
+ */
+/** @experimental */
+export type TaskClientExecutionMode = "background";
+/**
+ * Discriminator for a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientType".
+ */
+/** @experimental */
+export type TaskClientType = "client";
+/**
+ * Lifecycle status of a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientStatus".
+ */
+/** @experimental */
+export type TaskClientStatus = 
+/** The external owner is actively working. */
+"running"
+/** The external owner is connected but waiting. */
+ | "idle"
+/** The owner reported successful completion. */
+ | "completed"
+/** The owner reported failure. */
+ | "failed"
+/** The owner reported or confirmed cancellation. */
+ | "cancelled"
+/** The bound owner join disappeared; external executor state is unknown. */
+ | "orphaned";
+/**
+ * Connection class owning a client task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientOwnerKind".
+ */
+/** @experimental */
+export type TaskClientOwnerKind = 
+/** A discovered extension connection owns the task. */
+"extension"
+/** A generic SDK connection owns the task. */
+ | "sdk";
+/**
+ * Presence of the task's bound join.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientOwnerPresence".
+ */
+/** @experimental */
+export type TaskClientOwnerPresence = 
+/** The bound session join is connected. */
+"connected"
+/** The bound session join is disconnected. */
+ | "disconnected";
+/**
+ * Progress or terminal update for a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientUpdate".
+ */
+/** @experimental */
+export type TaskClientUpdate = {
+    status?: TaskClientActiveStatus;
+    /**
+     * Optional progress message appended to recent activity when nonempty
+     */
+    message?: string;
+    /**
+     * Optional progress phase; null clears the current phase
+     */
+    phase?: string | null;
+    /**
+     * Optional completion percentage; null clears the current percentage
+     */
+    percentage?: number | null;
+    /**
+     * Client task update variant discriminator.
+     */
+    kind: "progress";
+} | {
+    /**
+     * Optional final progress message
+     */
+    message?: string;
+    /**
+     * Optional opaque successful terminal result
+     */
+    result?: JsonValue;
+    /**
+     * Client task update variant discriminator.
+     */
+    kind: "completed";
+} | {
+    /**
+     * Optional final progress message
+     */
+    message?: string;
+    /**
+     * Human-readable terminal failure message
+     */
+    error: string;
+    /**
+     * Optional owner-supplied terminal failure code
+     */
+    code?: string;
+    /**
+     * Client task update variant discriminator.
+     */
+    kind: "failed";
+} | {
+    /**
+     * Optional final progress message
+     */
+    message?: string;
+    /**
+     * Optional human-readable cancellation reason
+     */
+    reason?: string;
+    /**
+     * Client task update variant discriminator.
+     */
+    kind: "cancelled";
+};
+/**
+ * Tracked task union returned by task APIs, containing an agent, client, or shell task.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "TaskInfo".
  */
 /** @experimental */
-export type TaskInfo = TaskAgentInfo | TaskShellInfo;
+export type TaskInfo = TaskAgentInfo | TaskClientInfo | TaskShellInfo;
 /**
  * Whether the shell runs inside a managed PTY session or as an independent background process
  *
@@ -3366,7 +3785,7 @@ export type TaskShellInfoAttachmentMode =
  * via the `definition` "TaskProgress".
  */
 /** @experimental */
-export type TaskProgress = (TaskAgentProgress | TaskShellProgress) | null;
+export type TaskProgress = TaskAgentProgress | TaskClientProgress | TaskShellProgress | null;
 /**
  * Canonical result returned by a session tool.
  *
@@ -3694,11 +4113,15 @@ export interface CopilotUserResponse {
      */
     organization_login_list?: string[];
     /**
-     * Organizations the user belongs to, each with an optional login and display name.
+     * Organizations the user belongs to, each with an optional ID, login, and display name.
      */
     organization_list?: ({
         [k: string]: unknown | undefined;
     } | ({
+        /**
+         * Numeric database ID of the organization.
+         */
+        id?: number;
         /**
          * GitHub login of the organization.
          */
@@ -4377,6 +4800,10 @@ export interface AgentInfo {
      * Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.
      */
     userInvocable?: boolean;
+    /**
+     * Whether model-driven invocation is disabled for this agent.
+     */
+    disableModelInvocation?: boolean;
     /**
      * Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.
      */
@@ -4741,13 +5168,82 @@ export interface AuthIdentity {
 /** @experimental */
 export interface AuthValidationError {
     /**
-     * Authentication validation error message
+     * Authentication validation error message
+     */
+    message: string;
+    /**
+     * Optional message returned by GitHub
+     */
+    githubMessage?: string;
+}
+/**
+ * Current per-window credit limit and consumption for an autopilot objective.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AutopilotObjectiveCreditLimit".
+ */
+/** @experimental */
+export interface AutopilotObjectiveCreditLimit {
+    /**
+     * Configured AI-credit cap, when one is set.
+     */
+    credits?: number;
+    /**
+     * Window consumption in fractional AI credits, for display.
+     */
+    creditsUsed: number;
+    /**
+     * Exact window consumption in non-negative integer nano-AIU, encoded as a decimal string.
+     */
+    creditsUsedNanoAiu: string;
+}
+/**
+ * Canonical runtime state for the session's current autopilot objective.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AutopilotObjectiveGetStateResult".
+ */
+/** @experimental */
+export interface AutopilotObjectiveGetStateResult {
+    /**
+     * Current objective state, or `null` when the session has no objective.
+     */
+    state: AutopilotObjectiveState | null;
+}
+/**
+ * Public, persistence-independent projection of an autopilot objective.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AutopilotObjectiveState".
+ */
+/** @experimental */
+export interface AutopilotObjectiveState {
+    /**
+     * Session-local objective identifier.
+     */
+    id: number;
+    /**
+     * User-provided objective text.
+     */
+    objective: string;
+    status: AutopilotObjectiveStatus;
+    /**
+     * Number of objective turns started.
      */
-    message: string;
+    turnCount: number;
     /**
-     * Optional message returned by GitHub
+     * Optional reason the objective is paused.
      */
-    githubMessage?: string;
+    pauseReason?: string;
+    /**
+     * Optional summary recorded when the objective completed.
+     */
+    completionSummary?: string;
+    /**
+     * Exact lifetime AI-credit consumption in non-negative integer nano-AIU, encoded as a decimal string.
+     */
+    creditCountNanoAiu: string;
+    creditLimit?: AutopilotObjectiveCreditLimit;
 }
 /**
  * The running runtime's complete catalog of well-known built-in model IDs, including supported models and additional IDs with built-in metadata.
@@ -5317,6 +5813,7 @@ export interface CatalogAiSkillCandidate {
     publisher?: string;
     source: CatalogCandidateSource;
     provenance: CatalogAiSkillCandidateProvenance;
+    trust?: CatalogTrustSnapshot;
 }
 /**
  * Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.
@@ -5369,6 +5866,112 @@ export interface CatalogAiSkillCandidateProvenance {
      */
     mediaType: "application/ai-skill";
 }
+/**
+ * A recognised current Agent Finder T1 or T2 trust tier.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotCurrent".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotCurrent {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotCurrentStatus;
+    tier: CatalogTrustTier;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustProvenance".
+ */
+/** @experimental */
+export interface CatalogTrustProvenance {
+    source: CatalogTrustSource;
+    /**
+     * ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field.
+     */
+    observedAt: string;
+}
+/**
+ * Discriminator: the authority omitted trust metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotAbsent".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotAbsent {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotAbsentStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly marked the assessment stale.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotStale".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotStale {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotStaleStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly reported a downgraded assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotDowngraded".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotDowngraded {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotDowngradedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly revoked the assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotRevoked".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotRevoked {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotRevokedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority supplied a bounded trust value this runtime does not understand.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotUnsupported".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotUnsupported {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotUnsupportedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotMalformed".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotMalformed {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotMalformedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
 /**
  * An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
  *
@@ -5423,6 +6026,7 @@ export interface CatalogMcpServerCandidate {
     publisher?: string;
     source: CatalogCandidateSource;
     provenance: CatalogMcpServerCandidateProvenance;
+    trust?: CatalogTrustSnapshot;
 }
 /**
  * Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
@@ -5574,9 +6178,11 @@ export interface CatalogNegotiationRefusedError {
      */
     minimumSupportedProtocolVersion: number;
     /**
-     * Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.
+     * Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation.
+     *
+     * @maxItems 32
      */
-    supportedCapabilities: CatalogCapability[];
+    supportedCapabilities: CatalogCapabilityId[];
     /**
      * The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.
      *
@@ -5782,6 +6388,55 @@ export interface CatalogUnavailableTransportError {
      */
     message: string;
 }
+/**
+ * Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ClientMetadata".
+ */
+/** @experimental */
+export interface ClientMetadata {
+    [k: string]: string | undefined;
+}
+/**
+ * Runtime-to-owner cancellation request for a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ClientTaskCancelRequest".
+ */
+/** @experimental */
+export interface ClientTaskCancelRequest {
+    /**
+     * Session that owns the client task
+     */
+    sessionId: string;
+    /**
+     * Canonical runtime-generated task identifier
+     */
+    id: string;
+    /**
+     * Owner-scoped task key included for correlation
+     */
+    clientTaskId: string;
+    /**
+     * Opaque identifier shared by coalesced cancellation callers
+     */
+    cancellationId: string;
+    reason: ClientTaskCancelReason;
+}
+/**
+ * Whether the client authoritatively confirmed its external work stopped.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ClientTaskCancelResult".
+ */
+/** @experimental */
+export interface ClientTaskCancelResult {
+    /**
+     * True only when the owner confirms that external work stopped before responding
+     */
+    cancelled: boolean;
+}
 /**
  * Slash commands available in the session, after applying any include/exclude filters.
  *
@@ -6235,7 +6890,7 @@ export interface ContextHeaviestMessage {
     tokens: number;
 }
 /**
- * The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
+ * The session's authoritative model snapshot. Auto preference fields are configuration for the virtual `auto` model and do not change the selected model identifier. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "CurrentModel".
@@ -6251,6 +6906,15 @@ export interface CurrentModel {
      */
     reasoningEffort?: string;
     contextTier?: ContextTier;
+    autoTier?: AutoTier;
+    /**
+     * Latest unclaimed Auto preference waiting for a future user turn. Null means the pending request is returning to provider-default routing.
+     */
+    pendingAutoTier?: AutoTier | null;
+    /**
+     * Auto preference currently claimed by an in-progress activation. Null means the activation is returning to provider-default routing.
+     */
+    activatingAutoTier?: AutoTier | null;
 }
 /**
  * Lightweight metadata for a currently initialized session tool
@@ -6560,11 +7224,73 @@ export interface DiscoveredMcpServer {
      * Plugin version that provided this server, when source is plugin.
      */
     sourcePluginVersion?: string;
+    effectiveSource?: McpSourceRef;
     /**
      * Whether the server is enabled (not in the disabled list)
      */
     enabled: boolean;
 }
+/**
+ * Canonical identity and location of the effective MCP server declaration. The declaration is uniquely addressed by this source id together with the discovered server name.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpSourceRef".
+ */
+/** @experimental */
+export interface McpSourceRef {
+    /**
+     * Open source-kind identifier. Known values include user, workspace, invocation, plugin, builtin, and device-registry.
+     */
+    kind: string;
+    /**
+     * Opaque stable identity for the configuration source. Clients must not parse this value.
+     */
+    id: string;
+    /**
+     * Open semantic editability identifier. Known values are editable and read-only.
+     */
+    editability: string;
+    file?: McpSourceFile;
+    plugin?: McpSourcePlugin;
+}
+/**
+ * Concrete configuration file containing an MCP server declaration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpSourceFile".
+ */
+/** @experimental */
+export interface McpSourceFile {
+    /**
+     * Canonical file URI for the configuration document
+     */
+    uri: string;
+    /**
+     * RFC 6901 JSON Pointer to the server declaration, when known
+     */
+    jsonPointer?: string;
+}
+/**
+ * Plugin identity associated with an MCP server declaration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpSourcePlugin".
+ */
+/** @experimental */
+export interface McpSourcePlugin {
+    /**
+     * Canonical plugin identity
+     */
+    id: string;
+    /**
+     * Human-readable plugin name, when available
+     */
+    name?: string;
+    /**
+     * Plugin version, when available
+     */
+    version?: string;
+}
 /**
  * Slash-prefixed command string to enqueue for FIFO processing.
  *
@@ -6672,7 +7398,7 @@ export interface EventsReadResult {
      */
     cursor: string;
     /**
-     * True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+     * True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.
      */
     hasMore: boolean;
     cursorStatus: EventsCursorStatus;
@@ -7130,6 +7856,10 @@ export interface FactoryAbortRequest {
      * Factory run identifier.
      */
     runId: string;
+    /**
+     * Opaque token identifying the execution attempt to abort.
+     */
+    executionToken: string;
 }
 /**
  * Acknowledgement that a factory request was accepted.
@@ -7161,12 +7891,12 @@ export interface FactoryAgentOptions {
      */
     model?: string;
     /**
-     * Optional reasoning effort for the subagent. This field is accepted but not yet honored.
+     * Optional reasoning effort override for the subagent.
      */
     reasoningEffort?: string;
     contextTier?: ContextTier;
     /**
-     * Optional custom agent name for the subagent. This field is accepted but not yet honored.
+     * Optional built-in or custom agent name whose definition configures the subagent.
      */
     agent?: string;
 }
@@ -7597,6 +8327,10 @@ export interface FactoryRunSummary {
      * Terminal run outcome, or null while nonterminal.
      */
     terminal: FactoryRunTerminal | null;
+    /**
+     * Whether the durable run state currently passes runtime resume eligibility checks.
+     */
+    canResume: boolean;
 }
 /**
  * Durable factory resource consumption.
@@ -7640,6 +8374,10 @@ export interface FactoryRunTerminal {
      * Prompt-safe preview of the completed result.
      */
     resultPreview?: string;
+    /**
+     * Pause initiator metadata, or null when the run did not pause.
+     */
+    pauseInfo: FactoryPauseInfo | null;
 }
 /**
  * One ordered factory progress line.
@@ -7680,6 +8418,44 @@ export interface FactoryLogRequest {
      */
     lines: FactoryLogLine[];
 }
+/**
+ * Parameters for an owned durable pause checkpoint.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseCheckpointRequest".
+ */
+/** @experimental */
+export interface FactoryPauseCheckpointRequest {
+    /**
+     * Factory run identifier.
+     */
+    runId: string;
+    /**
+     * Opaque token identifying the execution attempt that reached the checkpoint.
+     */
+    executionToken: string;
+    /**
+     * Stable author-defined checkpoint key.
+     */
+    key: string;
+}
+/** @experimental */
+export interface FactoryPauseCheckpointResult {
+    action: FactoryPauseCheckpointAction;
+}
+/**
+ * Parameters for pausing a running factory.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseRequest".
+ */
+/** @experimental */
+export interface FactoryPauseRequest {
+    /**
+     * Factory run identifier.
+     */
+    runId: string;
+}
 /**
  * Durable lifecycle and timing for one factory phase.
  *
@@ -7834,19 +8610,19 @@ export interface FactoryRunLimits {
     /**
      * Maximum number of factory subagents that may run concurrently.
      */
-    maxConcurrentSubagents?: number;
+    maxConcurrentSubagents?: number | null;
     /**
      * Maximum total number of factory subagents that may be admitted.
      */
-    maxTotalSubagents?: number;
+    maxTotalSubagents?: number | null;
     /**
      * Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted.
      */
-    timeoutSeconds?: number;
+    timeoutSeconds?: number | null;
     /**
      * Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.
      */
-    maxAiCredits?: number;
+    maxAiCredits?: number | null;
 }
 /**
  * Resolved persisted factory identity and resumed run envelope.
@@ -7896,6 +8672,7 @@ export interface FactoryRunResult {
      * Partial journal and progress snapshot for a halted, cancelled, or errored run.
      */
     snapshot?: JsonValue;
+    pauseInfo?: FactoryPauseInfo;
 }
 /**
  * Full factory run observability detail.
@@ -7972,6 +8749,10 @@ export interface FactoryRunDetail {
      * Terminal run outcome, or null while nonterminal.
      */
     terminal: FactoryRunTerminal | null;
+    /**
+     * Whether the durable run state currently passes runtime resume eligibility checks.
+     */
+    canResume: boolean;
     /**
      * Lifecycle and timing observations for each factory phase.
      */
@@ -8023,7 +8804,7 @@ export interface RunOptions {
     resumeFromRunId?: string;
 }
 /**
- * Optional user prompt to combine with the fleet orchestration instructions.
+ * Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "FleetStartRequest".
@@ -8034,6 +8815,14 @@ export interface FleetStartRequest {
      * Optional user prompt to combine with fleet instructions
      */
     prompt?: string;
+    /**
+     * Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request
+     */
+    attachments?: Attachment[];
+    /**
+     * If true, await completion of the agentic loop for this fleet request before returning. Defaults to false.
+     */
+    wait?: boolean;
 }
 /**
  * Indicates whether fleet mode was successfully activated.
@@ -10025,6 +10814,10 @@ export interface McpConfigRemoveRequest {
      * Name of the MCP server to remove
      */
     name: string;
+    /**
+     * OAuth Client ID Metadata Document URL whose persisted credentials should also be removed.
+     */
+    authClientIdMetadataUrl?: string;
 }
 /**
  * MCP server name and replacement configuration to write to user configuration.
@@ -10078,6 +10871,10 @@ export interface McpDiscoverRequest {
      * Working directory used as context for discovery (e.g., plugin resolution)
      */
     workingDirectory?: string;
+    /**
+     * Whether to include canonical effectiveSource metadata for each discovered server. Callers must opt in so protocol-3 clients retain the legacy closed response shape.
+     */
+    includeEffectiveSource?: boolean;
 }
 /**
  * MCP servers discovered from user, workspace, plugin, and built-in sources.
@@ -11240,6 +12037,7 @@ export interface McpServer {
      * Error message if the server failed to connect
      */
     error?: string;
+    serverMetadata?: McpServerMetadata;
 }
 /**
  * MCP servers configured for the session, with their connection status and host-level state.
@@ -11596,6 +12394,31 @@ export interface MetadataSnapshotRemoteMetadataRepository {
      */
     branch: string;
 }
+/**
+ * Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "MetadataUpdateClientMetadataRequest".
+ */
+/** @experimental */
+export interface MetadataUpdateClientMetadataRequest {
+    /**
+     * Remove every existing client metadata entry before applying remove and set. Defaults to false.
+     */
+    clear?: boolean;
+    /**
+     * Case-sensitive keys to remove. Missing keys are ignored. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces.
+     *
+     * @maxItems 128
+     */
+    remove?: string[];
+    /**
+     * String entries to add or replace. Set wins when a key also appears in remove. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Each value may contain at most 16 KiB of UTF-8 data.
+     */
+    set?: {
+        [k: string]: string | undefined;
+    };
+}
 /**
  * Copilot model metadata, including identifier, display name, capabilities, policy, billing, reasoning efforts, and picker categories.
  *
@@ -11613,6 +12436,12 @@ export interface Model {
      */
     name: string;
     capabilities: ModelCapabilities;
+    /**
+     * Provider-supplied model metadata. Keys and JSON-compatible values are preserved unchanged. This is factual metadata published by the model provider; it carries no picker or UX semantics.
+     */
+    metadata?: {
+        [k: string]: JsonValue | undefined;
+    };
     policy?: ModelPolicy;
     billing?: ModelBilling;
     /**
@@ -11926,6 +12755,10 @@ export interface ModelApplyStartupOverlayRequest {
      * Context tier selected by repository settings, when configured.
      */
     repoContextTier?: string;
+    /**
+     * Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant.
+     */
+    repoAutoTier?: string;
     /**
      * Model explicitly selected by the CLI, when provided.
      */
@@ -12053,6 +12886,44 @@ export interface ModelPickerSettingsContext {
      */
     environment: {};
 }
+/**
+ * Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSetAllowedModelsRequest".
+ */
+/** @experimental */
+export interface ModelSetAllowedModelsRequest {
+    /**
+     * Exact model IDs to permit, or null to clear the host restriction.
+     */
+    allowedModels?: string[] | null;
+}
+/**
+ * The applied host allowlist and effective session model policy after intersection.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSetAllowedModelsResult".
+ */
+/** @experimental */
+export interface ModelSetAllowedModelsResult {
+    /**
+     * Normalized host allowlist. Omitted when the host restriction was cleared, or when a relay client does not return the host policy.
+     */
+    allowedModels?: string[];
+    /**
+     * Effective exact IDs or repository policy patterns after applying the host restriction. Omitted by relay clients that do not return the host policy.
+     */
+    effectiveAllowedModels?: string[];
+    /**
+     * Effective deterministic fallback model, when the policy defines one.
+     */
+    fallbackModel?: string;
+    /**
+     * Selected session model after reconciling a now-disallowed concrete selection.
+     */
+    modelId?: string;
+}
 /**
  * Reasoning effort level to apply to the currently selected model.
  *
@@ -12080,15 +12951,52 @@ export interface ModelSetReasoningEffortResult {
     reasoningEffort: string;
 }
 /** @experimental */
-export interface ModelsListRequest {
+export interface ModelsListRequest {
+    /**
+     * Opaque account identifier returned by `account.getAllUsers`. When omitted, the current account is used.
+     */
+    selectionId?: string;
+    /**
+     * GitHub token accepted for compatibility with existing SDK clients. When provided, resolves this token instead of using the current account.
+     */
+    gitHubToken?: string;
+}
+/**
+ * An Auto preference request for the session. This updates Auto configuration only; it does not change the selected model to `auto`.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSwitchAutoTierRequest".
+ */
+/** @experimental */
+export interface ModelSwitchAutoTierRequest {
+    /**
+     * Auto preference to activate when a future user turn using the `auto` model safely mints a replacement model and token pair. Pass null to return to provider-default Auto routing.
+     */
+    autoTier: AutoTier | null;
+    source?: ModelChangeSource;
+}
+/**
+ * Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSwitchAutoTierResult".
+ */
+/** @experimental */
+export interface ModelSwitchAutoTierResult {
+    status: ModelSwitchAutoTierStatus;
+    effectiveAutoTier?: AutoTier;
     /**
-     * Opaque account identifier returned by `account.getAllUsers`. When omitted, the current account is used.
+     * Latest unclaimed Auto preference waiting for a future user turn.
      */
-    selectionId?: string;
+    pendingAutoTier?: AutoTier | null;
     /**
-     * GitHub token accepted for compatibility with existing SDK clients. When provided, resolves this token instead of using the current account.
+     * Auto preference currently claimed by an in-progress activation. Null means the activation is returning to provider-default routing.
      */
-    gitHubToken?: string;
+    activatingAutoTier?: AutoTier | null;
+    /**
+     * Earlier unclaimed preference replaced by this request. This can be present with either status, including when selecting the effective preference cancels pending work.
+     */
+    supersededAutoTier?: AutoTier | null;
 }
 /** @experimental */
 export interface ModelSwitchConfirmation {
@@ -12117,6 +13025,10 @@ export interface ModelSwitchToRequest {
      * Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model.
      */
     modelId: string;
+    /**
+     * Optional Auto routing preference to stage atomically with selecting `auto`. Pass null to return to provider-default Auto routing. This field is rejected when `modelId` is not `auto`.
+     */
+    autoTier?: AutoTier | null;
     /**
      * Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. "none" disables reasoning. When omitted, no effort override is applied.
      */
@@ -12189,6 +13101,7 @@ export interface ModelSwitchToResult {
      * Deprecation warnings associated with the selected model or options.
      */
     deprecationWarnings?: string[];
+    modelState?: CurrentModel;
 }
 /**
  * Agent interaction mode to apply to the session.
@@ -12199,6 +13112,7 @@ export interface ModelSwitchToResult {
 /** @experimental */
 export interface ModeSetRequest {
     mode: SessionMode;
+    expectedMode?: SessionMode;
     /**
      * Session whose plan-mode base state should be inherited.
      */
@@ -12253,6 +13167,10 @@ export interface ModeSetResult {
      * Whether applying the mode changed the active model.
      */
     modelChanged: boolean;
+    /**
+     * Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied.
+     */
+    modeApplied?: boolean;
     confirmation?: ModelSwitchConfirmation;
     /**
      * User-facing warning produced while applying the mode change.
@@ -14125,6 +15043,7 @@ export interface PluginInstallResult {
      * Number of skills discovered and installed from the plugin
      */
     skillsInstalled: number;
+    stagingMode?: PluginInstallStagingMode;
     /**
      * Optional post-install message provided by the plugin (e.g. setup instructions)
      */
@@ -14176,7 +15095,7 @@ export interface PluginsBuiltinSetRequest {
     paths: string[];
 }
 /**
- * Plugin names (or specs) to disable.
+ * Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "PluginsDisableRequest".
@@ -14187,9 +15106,13 @@ export interface PluginsDisableRequest {
      * Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.
      */
     names: string[];
+    /**
+     * Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory.
+     */
+    workingDirectory?: string;
 }
 /**
- * Plugin names (or specs) to enable.
+ * Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "PluginsEnableRequest".
@@ -14200,6 +15123,10 @@ export interface PluginsEnableRequest {
      * Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.
      */
     names: string[];
+    /**
+     * Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory.
+     */
+    workingDirectory?: string;
 }
 /**
  * Plugin source and optional working directory for relative-path resolution.
@@ -15913,6 +16840,18 @@ export interface SandboxConfig {
      * Whether to auto-add the current working directory to readwritePaths. Default: true.
      */
     addCurrentWorkingDirectory?: boolean;
+    /**
+     * Whether MCP servers the session launches are confined by the sandbox. Only an explicit `false` opts out; doing so also lets remote-MCP egress leave the sandbox, so the flag and `enabled` are always read together. Ignored while `enabled` is false. Default: true (enabled by default; set to false to opt out).
+     */
+    sandboxMcpServers?: boolean;
+    /**
+     * Whether language servers the session launches are confined by the sandbox. Only an explicit `false` opts out. Ignored while `enabled` is false. Default: true (enabled by default; set to false to opt out).
+     */
+    sandboxLspServers?: boolean;
+    /**
+     * Whether the agent may request that an individual command run outside the sandbox, which the host then approves or denies through the usual permission flow. A host capability flag rather than part of the policy: it is stripped from the effective spawn policy and only has an effect while `enabled` is true. Fail-closed, unlike the opt-out flags on this object: omitting it offers no bypass. Default: false (opt-in).
+     */
+    allowBypass?: boolean;
     auth?: SandboxConfigAuth;
     /**
      * Whether to auto-grant read access to tool directories discovered on PATH and in toolchain environment variables (GOROOT, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, config, and toolchains. Writable grants cover scratch caches, the Unix GitHub CLI cache, and Cargo's registry, git store, and lock/tracker files. A relocated CARGO_HOME gets the same narrow split: registry and git are read-write; bin is read-only; the home root, config.toml, and credentials.toml stay ungranted. Set to false to disable every grant listed above; user-installed toolchains and caches then need explicit userPolicy.filesystem readonlyPaths and readwritePaths entries. The working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted. Default: true (enabled by default; set to false to opt out).
@@ -16049,6 +16988,37 @@ export interface SandboxConfigAuth {
      */
     gh?: boolean;
 }
+/**
+ * Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxDisableForSessionRequest".
+ */
+/** @experimental */
+export interface SandboxDisableForSessionRequest {
+    /**
+     * Identifier of the exact pending sandbox-bypass permission request that authorized the session opt-out.
+     */
+    requestId: string;
+    decisionContext?: PermissionDecisionContext;
+}
+/**
+ * Result of attempting to disable sandboxing for the current session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxDisableForSessionResult".
+ */
+/** @experimental */
+export interface SandboxDisableForSessionResult {
+    /**
+     * Whether this call resolved the pending request and applied the session opt-out.
+     */
+    success: boolean;
+    /**
+     * The authoritative sandbox enabled state after the operation.
+     */
+    enabled: boolean;
+}
 /**
  * Managed sandbox enforcement state for a session.
  *
@@ -16710,7 +17680,7 @@ export interface SessionEnrichMetadataResult {
     sessions: LocalSessionMetadataValue[];
 }
 /**
- * File path, content to append, and optional mode for the client-provided session filesystem.
+ * File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsAppendFileRequest".
@@ -17604,6 +18574,10 @@ export interface SessionOpenOptions {
      * Identifier of the client driving the session.
      */
     clientName?: string;
+    /**
+     * OAuth Client ID Metadata Document URL used by this host for MCP authorization.
+     */
+    authClientIdMetadataUrl?: string;
     /**
      * Structured client kind used for runtime behavior gates.
      */
@@ -17751,6 +18725,10 @@ export interface SessionOpenOptions {
      * Whether to skip custom instruction sources.
      */
     skipCustomInstructions?: boolean;
+    /**
+     * Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process.
+     */
+    refreshCustomInstructions?: boolean;
     /**
      * Instruction source IDs disabled for this session.
      */
@@ -18669,6 +19647,27 @@ export interface SessionsGetBoardEntryCountResult {
      */
     count?: number;
 }
+/**
+ * Bounded batch request for client-owned metadata from persisted local sessions.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionsGetClientMetadataRequest".
+ */
+/** @experimental */
+export interface SessionsGetClientMetadataRequest {
+    /**
+     * Session IDs to inspect. Results preserve this order.
+     *
+     * @maxItems 1000
+     */
+    sessionIds: string[];
+    /**
+     * Case-sensitive keys to project from each valid bag. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Omit to return every entry.
+     *
+     * @maxItems 128
+     */
+    keys?: string[];
+}
 /**
  * Session ID whose event-log file path to compute.
  *
@@ -18882,11 +19881,11 @@ export interface SessionsReadPersistedEventsRequest {
      */
     sessionId: string;
     /**
-     * Opaque cursor returned by a previous persisted-event read. Omit on the first call.
+     * Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.
      */
     cursor?: string;
     /**
-     * Maximum number of events to return in this batch (1–1000, default 200).
+     * Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress.
      */
     max?: number;
     direction?: EventsReadDirection;
@@ -19695,6 +20694,7 @@ export interface SlashCommandTimelineEntry {
      * Optional URL associated with the timeline entry.
      */
     url?: string;
+    remediation?: RemediationAction;
 }
 /**
  * Slash-command invocation result that submits an agent prompt, with display prompt, optional mode, optional user-facing notice, and settings-change flag.
@@ -19913,7 +20913,7 @@ export interface SlashCommandSetPlanModelResult {
     runtimeSettingsChanged?: boolean;
 }
 /**
- * Subagent model, reasoning effort, and context tier settings
+ * Subagent model, reasoning effort, context tier, and auto-invocation settings
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SubagentSettingsEntry".
@@ -19930,6 +20930,10 @@ export interface SubagentSettingsEntry {
      */
     effortLevel?: string;
     contextTier?: SubagentSettingsEntryContextTier;
+    /**
+     * Whether this agent's runtime-defined proactive invocation prompting is enabled, if supported. Currently consumed by the built-in rubber-duck agent.
+     */
+    autoInvoke?: boolean;
 }
 /**
  * Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.
@@ -20052,6 +21056,157 @@ export interface TaskProgressLine {
      */
     timestamp: string;
 }
+/**
+ * Tracked client-owned task metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientInfo".
+ */
+/** @experimental */
+export interface TaskClientInfo {
+    type: TaskClientType;
+    /**
+     * Canonical runtime-generated task identifier
+     */
+    id: string;
+    /**
+     * Owner-scoped registration and reclaim key
+     */
+    clientTaskId: string;
+    /**
+     * Optional task display name
+     */
+    displayName?: string;
+    /**
+     * Task description
+     */
+    description: string;
+    status: TaskClientStatus;
+    owner: TaskClientOwner;
+    /**
+     * ISO 8601 timestamp when the task started
+     */
+    startedAt: string;
+    /**
+     * ISO 8601 timestamp of the latest accepted lifecycle change
+     */
+    updatedAt: string;
+    /**
+     * ISO 8601 timestamp when the task reached a terminal status
+     */
+    completedAt?: string;
+    /**
+     * Accumulated active execution time in milliseconds
+     */
+    activeTimeMs: number;
+    /**
+     * ISO 8601 timestamp when the current active segment started
+     */
+    activeStartedAt?: string;
+    /**
+     * ISO 8601 timestamp when the connected owner entered idle status
+     */
+    idleSince?: string;
+    /**
+     * ISO 8601 timestamp of the most recent orphan transition
+     */
+    orphanedAt?: string;
+    /**
+     * ISO 8601 timestamp of the most recent successful reclaim
+     */
+    reclaimedAt?: string;
+    executionMode: TaskClientExecutionMode;
+    /**
+     * Whether the currently bound owner can receive a cancellation request
+     */
+    canCancel: boolean;
+    /**
+     * Sequence number of the latest accepted owner update
+     */
+    sequence: number;
+    /**
+     * Opaque successful terminal result supplied by the task owner
+     */
+    result?: JsonValue;
+    /**
+     * Human-readable terminal failure message
+     */
+    error?: string;
+    /**
+     * Optional owner-supplied terminal failure code
+     */
+    errorCode?: string;
+    /**
+     * Human-readable reason for terminal cancellation
+     */
+    cancellationReason?: string;
+}
+/**
+ * Public owner attribution for a client-owned task. Identifiers are opaque and never authorize requests.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientOwner".
+ */
+/** @experimental */
+export interface TaskClientOwner {
+    /**
+     * Opaque session-scoped participant identity
+     */
+    participantId: string;
+    /**
+     * Opaque identity of the currently or most recently bound session join
+     */
+    joinId: string;
+    kind: TaskClientOwnerKind;
+    /**
+     * Display-only owner name
+     */
+    displayName?: string;
+    /**
+     * Display-only owner source
+     */
+    source?: string;
+    presence: TaskClientOwnerPresence;
+    /**
+     * ISO 8601 timestamp when the bound join disconnected
+     */
+    disconnectedAt?: string;
+}
+/**
+ * Generic progress for a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskClientProgress".
+ */
+/** @experimental */
+export interface TaskClientProgress {
+    type: TaskClientType;
+    status: TaskClientStatus;
+    /**
+     * Sequence number of the latest accepted owner update
+     */
+    sequence: number;
+    /**
+     * ISO 8601 timestamp of the latest accepted lifecycle change
+     */
+    updatedAt: string;
+    /**
+     * Current owner-defined progress phase
+     */
+    phase?: string;
+    /**
+     * Current completion percentage from zero through one hundred
+     */
+    percentage?: number;
+    /**
+     * Most recent nonempty progress message
+     */
+    lastMessage?: string;
+    /**
+     * Recent server-timestamped progress messages
+     */
+    recentActivity: TaskProgressLine[];
+}
 /** @experimental */
 export interface TaskCompletionDecision {
     outcome: TaskCompletionOutcome;
@@ -20269,6 +21424,54 @@ export interface TasksPromoteToBackgroundResult {
 /** @experimental */
 export interface TasksRefreshResult {
 }
+/**
+ * Registers or reclaims a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TasksRegisterRequest".
+ */
+/** @experimental */
+export interface TasksRegisterRequest {
+    type: TaskClientType;
+    /**
+     * Owner-scoped idempotency key used for registration and reclaim
+     */
+    clientTaskId: string;
+    /**
+     * Human-readable description of the external work
+     */
+    description: string;
+    /**
+     * Optional short display name for the external work
+     */
+    displayName?: string;
+    /**
+     * Whether the owner supports runtime cancellation requests
+     */
+    cancellable: boolean;
+    /**
+     * Expected current sequence for idempotent registration or orphan reclaim
+     */
+    expectedSequence?: number;
+}
+/**
+ * Result of registering or reclaiming a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TasksRegisterResult".
+ */
+/** @experimental */
+export interface TasksRegisterResult {
+    task: TaskClientInfo;
+    /**
+     * True only when this invocation created a new task
+     */
+    created: boolean;
+    /**
+     * True only when this invocation reclaimed an orphaned task
+     */
+    reclaimed: boolean;
+}
 /**
  * Identifier of the completed or cancelled task to remove from tracking.
  *
@@ -20375,6 +21578,42 @@ export interface TasksStartAgentResult {
      */
     agentId: string;
 }
+/**
+ * Updates a client-owned task.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TasksUpdateRequest".
+ */
+/** @experimental */
+export interface TasksUpdateRequest {
+    /**
+     * Canonical runtime-generated task identifier
+     */
+    id: string;
+    /**
+     * Owner update sequence to apply
+     */
+    sequence: number;
+    update: TaskClientUpdate;
+}
+/**
+ * Result of publishing a client-owned task update.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TasksUpdateResult".
+ */
+/** @experimental */
+export interface TasksUpdateResult {
+    task: TaskClientInfo;
+    /**
+     * Whether this invocation changed task state
+     */
+    applied: boolean;
+    /**
+     * Whether this invocation repeated the latest accepted update
+     */
+    duplicate: boolean;
+}
 /**
  * Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).
  *
@@ -22130,6 +23369,10 @@ export interface WorkspacesWriteAutopilotObjectiveResult {
     operation: string;
 }
 /** @experimental */
+export interface SessionFactoryPauseAtCheckpointResult {
+    action: FactoryPauseCheckpointAction;
+}
+/** @experimental */
 export interface SessionModelListRequest {
     /**
      * If true, bypasses the per-session model list cache and re-fetches from CAPI.
@@ -22493,13 +23736,13 @@ export declare function createServerRpc(connection: MessageConnection): {
         /**
          * Enables installed plugins for new sessions.
          *
-         * @param params Plugin names (or specs) to enable.
+         * @param params Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.
          */
         enable: (params: PluginsEnableRequest) => Promise<void>;
         /**
          * Disables installed plugins for new sessions.
          *
-         * @param params Plugin names (or specs) to disable.
+         * @param params Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.
          */
         disable: (params: PluginsDisableRequest) => Promise<void>;
         /** @experimental */
@@ -22666,6 +23909,10 @@ export declare function createServerRpc(connection: MessageConnection): {
          * @returns Validated device-managed settings discovered before a session exists.
          */
         read: () => Promise<ManagedSettingsReadResult>;
+        /**
+         * Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing "sync account policy" should start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.
+         */
+        clearCache: () => Promise<void>;
     };
     /** @experimental */
     runtime: {
@@ -22745,7 +23992,15 @@ export declare function createServerRpc(connection: MessageConnection): {
          */
         list: (params: SessionsListRequest) => Promise<SessionList>;
         /**
-         * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.
+         * Reads client-owned metadata for multiple persisted local sessions without opening them. Results preserve request order and report missing, corrupt, unsupported, or temporarily unavailable sessions independently.
+         *
+         * @param params Bounded batch request for client-owned metadata from persisted local sessions.
+         *
+         * @returns Ordered client metadata outcomes for the requested local sessions.
+         */
+        getClientMetadata: (params: SessionsGetClientMetadataRequest) => Promise<SessionsGetClientMetadataResult>;
+        /**
+         * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.
          *
          * @param params Pagination options for reading an inactive or active local session's persisted event journal.
          *
@@ -22949,6 +24204,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Managed sandbox enforcement state for a session.
          */
         getEnforcementStatus: () => Promise<SandboxEnforcementStatus>;
+        /**
+         * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
+         *
+         * @param params Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
+         *
+         * @returns Result of attempting to disable sandboxing for the current session.
+         */
+        disableForSession: (params: SandboxDisableForSessionRequest) => Promise<SandboxDisableForSessionResult>;
     };
     /**
      * Aborts the current agent turn.
@@ -23112,6 +24375,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Complete current or terminal factory run envelope.
          */
         cancel: (params: FactoryCancelRequest) => Promise<FactoryRunResult>;
+        /**
+         * Pauses a running factory and returns its settled run envelope.
+         *
+         * @param params Parameters for pausing a running factory.
+         *
+         * @returns Complete current or terminal factory run envelope.
+         */
+        pause: (params: FactoryPauseRequest) => Promise<FactoryRunResult>;
         /**
          * Records a batch of ordered factory progress lines.
          *
@@ -23151,9 +24422,9 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
     /** @experimental */
     model: {
         /**
-         * Gets the currently selected model for the session.
+         * Gets the session's authoritative model snapshot, including the committed Auto preference and any newer unclaimed Auto preference waiting for a future user turn.
          *
-         * @returns The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
+         * @returns The session's authoritative model snapshot. Auto preference fields are configuration for the virtual `auto` model and do not change the selected model identifier. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
          */
         getCurrent: () => Promise<CurrentModel>;
         /**
@@ -23164,6 +24435,22 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns The model identifier active on the session after the switch.
          */
         switchTo: (params: ModelSwitchToRequest) => Promise<ModelSwitchToResult>;
+        /**
+         * Requests an Auto preference change without changing the session's selected model. The latest unclaimed request wins; the runtime commits it only after a later prompt using the `auto` model mints a usable model and token pair. A `pending` response confirms that the request was accepted, not that it committed. Observe eventual success through `session.model_change`, failure through the ephemeral `session.auto_tier_switch_failed` event, or current unclaimed state through `session.model.getCurrent`.
+         *
+         * @param params An Auto preference request for the session. This updates Auto configuration only; it does not change the selected model to `auto`.
+         *
+         * @returns Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed.
+         */
+        switchAutoTier: (params: ModelSwitchAutoTierRequest) => Promise<ModelSwitchAutoTierResult>;
+        /**
+         * Replaces or clears the host-supplied model allowlist for a running session.
+         *
+         * @param params Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.
+         *
+         * @returns The applied host allowlist and effective session model policy after intersection.
+         */
+        setAllowedModels: (params: ModelSetAllowedModelsRequest) => Promise<ModelSetAllowedModelsResult>;
         /**
          * Updates the session's reasoning effort without changing the selected model.
          *
@@ -23370,6 +24657,15 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
         diff: (params: WorkspacesDiffRequest) => Promise<WorkspaceDiffResult>;
     };
     /** @experimental */
+    autopilotObjective: {
+        /**
+         * Reads the current canonical autopilot objective state for this session.
+         *
+         * @returns Canonical runtime state for the session's current autopilot objective.
+         */
+        getState: () => Promise<AutopilotObjectiveGetStateResult>;
+    };
+    /** @experimental */
     completions: {
         /**
          * Gets the characters that should trigger host-driven completions for the session. Empty disables host-driven completions (e.g. local sessions, or a relay host that does not advertise them).
@@ -23400,7 +24696,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
         /**
          * Starts fleet mode by submitting the fleet orchestration prompt to the session.
          *
-         * @param params Optional user prompt to combine with the fleet orchestration instructions.
+         * @param params Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
          *
          * @returns Indicates whether fleet mode was successfully activated.
          */
@@ -23463,6 +24759,22 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Background tasks currently tracked by the session.
          */
         list: () => Promise<TaskList>;
+        /**
+         * Registers a client-owned task, or reclaims an orphaned task belonging to the same extension principal.
+         *
+         * @param params Registers or reclaims a client-owned task.
+         *
+         * @returns Result of registering or reclaiming a client-owned task.
+         */
+        register: (params: TasksRegisterRequest) => Promise<TasksRegisterResult>;
+        /**
+         * Publishes generic progress or a terminal outcome for a client-owned task.
+         *
+         * @param params Updates a client-owned task.
+         *
+         * @returns Result of publishing a client-owned task update.
+         */
+        update: (params: TasksUpdateRequest) => Promise<TasksUpdateResult>;
         /**
          * Refreshes metadata for any detached background shells the runtime knows about.
          *
@@ -23926,7 +25238,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          */
         set: (params: ToolsSetRequest) => Promise<ToolsSetResult>;
         /**
-         * Updates the current session's live subagent settings after user settings change. The persisted user settings remain the source of truth for future sessions.
+         * Sets the current session's live subagent settings override, which takes precedence over persisted user settings until cleared. Persisted user settings remain the source of truth for future sessions.
          *
          * @param params Subagent settings to apply to the current session
          *
@@ -24276,6 +25588,20 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Point-in-time snapshot of slow-changing session identifier and state fields
          */
         snapshot: () => Promise<SessionMetadataSnapshot>;
+        /**
+         * Returns the client-owned string metadata persisted with this local session. The metadata is not included in model context, events, telemetry, snapshots, or remote exports.
+         *
+         * @returns Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+         */
+        getClientMetadata: () => Promise<ClientMetadata>;
+        /**
+         * Atomically patches the client-owned string metadata persisted with this local session and returns the committed bag.
+         *
+         * @param params Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.
+         *
+         * @returns Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+         */
+        updateClientMetadata: (params: MetadataUpdateClientMetadataRequest) => Promise<ClientMetadata>;
         /**
          * Reports whether the local session is currently processing user/agent messages.
          *
@@ -24664,6 +25990,18 @@ export interface FactoryHandler {
      */
     abort(params: FactoryAbortRequest): Promise<FactoryAckResult>;
 }
+/** Handler for `tasks` client session API methods. */
+/** @experimental */
+export interface TasksHandler {
+    /**
+     * Asks the client currently bound to a client-owned session task to confirm that its external work stopped.
+     *
+     * @param params Runtime-to-owner cancellation request for a client-owned task.
+     *
+     * @returns Whether the client authoritatively confirmed its external work stopped.
+     */
+    cancel(params: ClientTaskCancelRequest): Promise<ClientTaskCancelResult>;
+}
 /** Handler for `sessionFs` client session API methods. */
 /** @experimental */
 export interface SessionFsHandler {
@@ -24684,9 +26022,9 @@ export interface SessionFsHandler {
      */
     writeFile(params: SessionFsWriteFileRequest): Promise<SessionFsError | undefined>;
     /**
-     * Appends content to a file in the client-provided session filesystem.
+     * Appends content to a file in the client-provided session filesystem, creating parent directories as needed.
      *
-     * @param params File path, content to append, and optional mode for the client-provided session filesystem.
+     * @param params File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.
      *
      * @returns Describes a filesystem error.
      */
@@ -24802,6 +26140,7 @@ export interface CanvasHandler {
 export interface ClientSessionApiHandlers {
     providerToken?: ProviderTokenHandler;
     factory?: FactoryHandler;
+    tasks?: TasksHandler;
     sessionFs?: SessionFsHandler;
     canvas?: CanvasHandler;
 }